As companies around the world deal with the COVID-19 crisis, dozens of trade organizations across multiple industries want California’s attorney general to delay enforcing the state’s new data privacy law until 2021.
In a letter sent to California Attorney General Xavier Becerra, influential marketing groups including the Association of National Advertisers, 4As, Interactive Advertising Bureau said they want “temporary forbearance” until Jan. 2, 2021, as marketers deal with the ongoing health and economic worries caused by the coronavirus. The letter, sent to Becerra’s office this week, was also co-signed by an array of other industries ranging from banking and real estate to insurance and even the toy industry.
In the letter, the groups wrote that consumer privacy is “an important value that deserves meaningful protections in the marketplace,” but expressed concerns about how the ongoing pandemic make it difficult to comply with the law, the California Consumer Privacy Act, which was passed in 2018 and went into effect on January 1, 2020. However, the AG’s office is still in the stages of drafting and amending regulations for CCPA, which is set to be enforced beginning July 1. The law—aimed at companies with annual gross revenue of more than $25 million or that have data on more than 50,000 consumers—regulates how businesses can collect personal data from California residents and how that information can be shared and used. It also gives consumers in the state the right to request companies delete information stored about them and also to receive a report detailing exactly what data a company has on file.
“The undersigned organizations employ millions of individuals who are faced with this crisis and are doing their best to manage their personal and professional lives in the face of uncertain times,” the letter states. “Many companies have instituted mandatory work-from-home measures to limit community spread of the virus, meaning that the individuals who are responsible for creating processes to comply with CCPA are not present in the office to undertake such tasks. Developing innovative business procedures to comply with brand-new legal requirements is a formidable undertaking on its own, but it is an especially tall order when there are no dedicated, on-site staff available to build and test necessary new systems and processes.”
While compliance costs to businesses are still uncertain, estimates vary. Last year, an economic impact assessment prepared for the attorney general’s office by an independent research firm found that companies could spend up to $55 billion on legal fees, technology and operational costs to become compliant. However, the report also said those costs would vary depending on the size of a business. While smaller firms with less than 20 employees could face $50,000 in initial costs, companies with more than 500 employees could see costs on average of $2 million.
The trade groups represented by this week’s letter also argue that the AG’s final regulations are not yet complete and therefore make it hard to comply, and claim that some of the proposed regulations are not required by the law itself. A third draft of the regulations is currently in a comment period until March 27, and anyone can submit commentary about how the law affects businesses and consumers.
“These new mandates will materially impact how the CCPA is operationalized and will place extensive strain on companies attempting to achieve full compliance before enforcement may begin,” according to the letter. “Creating procedures and processes to comply with a law like the CCPA takes time, testing, and significant planning and foresight. Even in the most favorable of circumstances, presuming that companies will be able to achieve full compliance with brand-new substantive obligations within mere months of those obligations becoming final is an unrealistic and daunting expectation.”
Asked for comment about the trade groups’ request, an advisor to Becerra said there are no current plans to delay enforcement.
“Right now, we’re committed to enforcing the law upon finalizing the rules or July 1, whichever comes first,” the advisor said in an email to Forbes. “We’re all mindful of the new reality created by COVID-19 and the heightened value of protecting consumers’ privacy online that comes with it. We encourage businesses to be particularly mindful of data security in this time of emergency.”
While the letter says the trade groups “strongly support the underlying purpose and goals” of the CCPA, groups like the ANAs, 4As and IAB have been fighting to pass national legislation that would preempt California’s law. It’s also not the first time the groups have requested a delay. Even before COVID-19 sparked a global crisis, the ANA, IAB, 4As, American Advertising Federation, and the Network Advertising Initiative sent Becerra a letter in late January asking for an extension to address uncertainties about the draft regulations and also to find ways to comply.